ΕΣGreek School Rotterdam

Privacy Policy

Version 2.0 · Effective date: 5 October 2026 · Last updated: 19 October 2026 (comments of the Wix group are copied too; staff may post in the Wix group from the Portal during the move; 18 October: the School’s mailbox can be read and answered in the Portal by the full administrators, the Secretary and the President; earlier, 17 October: fees and refunds — the School's bank statements are imported into the Portal)

This Privacy Policy explains how Greek School Rotterdam (Ελληνικό Σχολείο Ρότερνταμ, also referred to as “TEG Rotterdam”, “the School”, “we”, “us”) collects, uses, shares and protects personal data when you use the School Portal (including the staff portal, the online registration form and the Parent Portal) at grschool-rotterdam-2026.netlify.app (the “Portal”), and when we communicate with you by email.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR / Algemene verordening gegevensbescherming, AVG) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).

1. Who is responsible for your data

The data controller is:

Vereniging van Ouders Griekse School Rotterdam
trading as Greek School Rotterdam (Ελληνικό Σχολείο Ρότερνταμ)
Maria Danneels Erf 18, 2907 BD Capelle aan den IJssel, the Netherlands
Chamber of Commerce (KvK) number: 24344917
Email: elliniko.scholio.rott@gmail.com

The School is not required to appoint a Data Protection Officer. Questions about this policy or about your data can be sent to the email address above.

2. Whose data we process

3. What data we process

CategoryExamplesSource
Student identity and enrolmentStudent number, family number, first name, surname, date of birth, sex, level and class, class day and time, school year, registration type, the student’s regular (day) school and country, enrolment statusParent (registration form) or School
Parent / guardian contact detailsNames of father and mother/guardians, email addresses, mobile numbers, home address, postcode and cityParent
Proof of ageAt registration, parents may upload a scan or photo of the child’s birth certificate, passport or ID card (or show the original at the registration day at school). The School records only that the document was checked, its type, who checked it and when. The scan itself is deleted 30 days after the check. You may cover the citizen service number (BSN) before uploading: we only need the child’s name and date of birthParent
Leaving the SchoolWhen a student leaves: the date and a reason chosen from a short list (for example “moved away”, “changed to another school”, “cost”), with an optional short note. When a record is deleted, the reason is kept in the audit log; the School also keeps an anonymous count per school year and reason, without namesParent, School
Registration declarationThe handwritten signature drawn on the registration form, with the date of signingParent
School documents and confirmationsDocuments the School publishes in the Portal (rules, letters, class material, board documents), who published or approved them, and — when a document asks for it — each parent’s confirmation that they have read and accept it: the tick, the full name typed by the parent, the drawn signature and the date and timeSchool, parent
Forms per child (each school year)Safe pick-up: up to three people who may collect the child (name, relation, phone) and, for secondary pupils only, whether the child may go home alone. Photo consent: separate yes/no choices for the website, newsletters, the calendar/yearbook and social media. Each form is saved with the name, drawn signature and date and time of the parent who filled it inParent
Trip and event consentPer child: yes or no, whether the parent can help or accompany, an optional note (for example an allergy), the parent’s typed name, drawn signature and the date and timeParent
Financial dataBank account number (IBAN) given for school fees, subscription/fee payment status, payment and transaction records kept by the Accountant. Per family and school year: the fee due, an instalment plan if you asked for one (with its dates), the payments received (date, amount, bank reference), and if your children stop during the trial period the withdrawal date, the refund under the school rules and its approvalParent, School
Bank statement dataThe School's own bank statements (ING) are imported into the Portal so that payments are recognised: for each payment to or from the School, the name and IBAN of the account holder, the date, the amount, the description and reference they typed, and the bank's transaction code. The Portal may remember that an IBAN pays for a family, so that the next payment is recognised. Your bank never sends us anything else, and we never have access to your accountThe School's bank (ING)
School progress and attendanceAttendance and absences, absence reasons reported by parents, teacher feedback and notes about a student’s progress, parent-teacher meeting bookings and notes, meeting attendance (RSVP)Teachers, parents, School
CommunicationsChat messages in the Portal (private chats and group chats), attachments you upload, read status (when you last read a chat), message groups, people you blocked and messages you reported, emails sent from the Portal and the log of those emails (recipients, subject, date, delivery status), replies you send to the School by email, and copies of messages you exchanged with the School through its Wix website (site chat, contact form, the Wix group “Είμαι Γονιός”)You, the School, the School’s Wix website
Contact form messagesWhen you use the contact form on our website: your name, email address, the subject you choose, your message, the language of the form and the date and time. Also the answers the School sends you by email, your email replies to those answers, who in the office handled your message, its status and an internal note. You do not get an automatic confirmation email; you only receive the School’s answerYou, the School
Staff dataName, title, email, mobile, address, role, the classes taught, start and end dates, active status and, for external teachers, agreed ratesStaff member, School
Account and security dataLogin email, password (stored only as a one-way encrypted hash), role and permissions, login sessions, password-reset requests, and an audit log of changes made in the Portal (who changed what, and when)Generated by the Portal
Technical dataIP address, browser type and request times, processed by our hosting providers to deliver the Portal and keep it secureYour device

The School may add extra fields to student records for school administration. We will not use them to collect more data than is necessary for the purposes below.

4. Why we process your data and on what legal basis

PurposeLegal basis (GDPR Art. 6)
Handling registrations and enrolment; organising levels, classes and teachers; running lessonsPerformance of the enrolment agreement with the parents (6(1)(b))
Checking the child’s age at registration (the levels and classes depend on age); recording why a student left, so the School can plan classes and improvePerformance of the enrolment agreement with the parents (6(1)(b)); the School’s legitimate interest in sound administration (6(1)(f))
Planning the classes of a school year (Class planner): which class, day, time, room and teacher each child gets. To keep siblings on the same day and to let neighbours share the trip, the planner uses the family number and only the first four digits of the postcode (the area — never the street or house number); to suggest a class and warn when a child is outside the usual age of a class, it uses the date of birth. The planner runs inside the Portal: no data is sent to any other servicePerformance of the enrolment agreement (6(1)(b)) and the School’s legitimate interest in organising classes that suit families (6(1)(f))
Recording attendance, informing parents about absences, and receiving absence reports from parentsPerformance of the agreement (6(1)(b)) and our legitimate interest in the safety and supervision of pupils (6(1)(f))
Recording progress and feedback; parent-teacher meetingsPerformance of the agreement (6(1)(b))
Communicating with parents and staff through Portal messages and email (school news, class information, meetings)Performance of the agreement (6(1)(b)) and legitimate interest in running the School (6(1)(f))
Sharing school documents with parents and staff, and recording that parents have read and accepted themPerformance of the enrolment agreement (6(1)(b)) and legitimate interest in being able to show that rules and terms were made known (6(1)(f))
Safe pick-up: knowing who may collect a child, and whether a secondary pupil may go home aloneLegitimate interest in the safety and supervision of pupils (6(1)(f))
Using photos or videos of pupils on the website, in newsletters, in the calendar/yearbook or on social mediaConsent of the parent, given separately for each use (6(1)(a)). Without a “yes” we do not publish recognisable images of the child. Parents can change their choices at any time in the Parent Portal; this does not affect what was published before the change
Organising trips and events: consent per child, help offered by parents, notes for the teachersPerformance of the agreement (6(1)(b)) and the parent’s consent for the specific trip (6(1)(a))
Collecting school fees and keeping financial recordsPerformance of the agreement (6(1)(b)) and legal obligations, including Dutch tax record-keeping rules (6(1)(c))
Answering questions sent with the contact form on our websiteLegitimate interest in answering the questions people send us (6(1)(f)); for questions about registering a child, steps taken at your request before an enrolment agreement (6(1)(b))
Managing teacher and office accounts, roles and permissionsPerformance of the volunteer, assignment or employment relationship (6(1)(b)) and legitimate interest (6(1)(f))
Security: login protection, audit logs, preventing misuse and fraud, restoring dataLegitimate interest in protecting the Portal and the data in it (6(1)(f))
Complying with requests from authorities and handling legal claimsLegal obligation (6(1)(c)) and legitimate interest (6(1)(f))

Where we rely on legitimate interest, we have balanced our interests against your rights. You may object at any time (see section 14). Where we ask for your consent for a specific purpose, you can withdraw it at any time without affecting earlier processing.

We do not sell personal data, we do not use it for advertising and we do not build marketing profiles.

5. Children’s data

Students do not have their own accounts in the Portal. Data about a child is provided and managed by the child’s parents or guardians and by the School. Parents can see the data about their own children in the Parent Portal, and they can exercise the rights in section 14 on behalf of children under 16.

6. Sensitive data

We do not ask for special categories of personal data (such as health, religion or ethnicity) and we do not need them to run the School. Please do not include such information in messages or free-text fields unless it is needed for your child’s safety at school (for example a serious allergy). If you choose to give us such information, we use it only for that purpose, share it only with the staff who need to know, and process it on the basis of your explicit consent (GDPR Art. 9(2)(a)), which you can withdraw at any time.

We do not collect citizen service numbers (BSN).

7. Who can see your data

Access within the School is limited by role, and each person sees only what their role requires:

Documents and forms are stored in a private storage area. They are never available through a public link: each time someone opens a file, the Portal first checks that they may see it and then gives a link that works for a few minutes only. Every opening of a board document is recorded in the audit log.

We share data outside the School only with the service providers listed below, or where the law requires it. We may also share it with your consent, or to protect someone’s vital interests.

8. Service providers (processors)

We use the following service providers to run the Portal. They process personal data only on our instructions and under data processing terms that meet GDPR Art. 28.

ProviderServiceLocation of processing
Supabase, Inc.Database, user accounts and login, private file storage for message attachments and school documentsData stored in the EU (Ireland, AWS eu-west-1); support and sub-processors may be in the USA
Netlify, Inc.Website hosting and the server functions of the PortalGlobal network, including the USA
Google LLC / Google Ireland Ltd (Gmail)Sending the School’s emails and receiving replies in the School’s mailboxEU and USA
Wix.com Ltd.The School’s previous website, site chat and member group. During the move to the Portal, the Portal reads messages and group posts from it (see section 7)Israel (EU adequacy decision), EU and USA
Kadaster — PDOK Locatieserver (Dutch government address register, BAG)Filling in the street and town on the registration form from the postcode and house number, and checking that the address exists. Only the postcode and house number are sent (through the Portal’s server) — no names or other details.Netherlands
Cloudflare, Inc. (Turnstile)The security check on the registration and contact forms, which tells people and automated programs apart. Cloudflare receives your IP address and technical browser signals for this check only; it sets no tracking cookies and the result is not used for anything else.Global
Google Fonts, jsDelivr and cdnjs/Cloudflare (content delivery networks)Delivering fonts, icons and program libraries to your browser. These receive your IP address and browser information when the page loads.Global

9. Transfers outside the European Economic Area

Some of the providers above are based in the United States or use sub-processors there. Where personal data is transferred outside the EEA, we rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (for certified providers) and/or the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information about these safeguards.

10. Emails and notifications

11. Cookies and local storage

The Portal does not use advertising or analytics cookies, and it does not track you across other websites. It uses your browser’s local storage only for things that are strictly necessary or that you choose:

Under the Dutch Telecommunications Act (Telecommunicatiewet, Art. 11.7a), strictly necessary storage does not require consent. When a page loads fonts or icons from the providers in section 8, your browser connects to them directly, and they receive your IP address.

12. How long we keep data

We keep personal data no longer than necessary for the purposes for which it was collected:

DataRetention period
Registrations from the website whose email address was never confirmedDeleted automatically 14 days after they were sent, with any uploaded proof of age. A registration only reaches the School after the parent who filled in the form has clicked the confirmation link (valid 7 days)
Refused attempts on the registration and contact formsOnly a count per day and reason (for example “too fast” or “security check failed”) — no names, email or IP addresses
Registration applications that are not accepted, or are withdrawnDeleted at the latest at the end of the school year in which they were submitted
Student records, attendance, feedback and meeting notesFor the duration of the enrolment and up to 2 school years after the student has left, unless longer retention is required by law. When a student record is deleted, the related attendance, feedback and bookings are deleted with it.
Proof of age (scan of the birth certificate, passport or ID card)Deleted automatically 30 days after the School has checked it. Only the tick “age checked”, the type of document, who checked it and the date stay on the student record. If the student record is deleted earlier, the scan is deleted with it
Reason for leavingKept on the student record while the record is kept; cleared when the student becomes active again
Parent accountsThe Parent Portal login is paused automatically when a parent no longer has an enrolled child. The account is deleted when the last of their children’s records is deleted, or earlier at the parent’s request.
Contact form messages and the answers to them3 years after the message was closed (messages set aside as spam: 3 years after they arrived, or earlier when they are deleted by hand), then deleted. Open messages are kept until they are closed
Financial records (fees, payments, refunds, transactions, imported bank statement data — payers' names and IBANs)7 years, as required by Dutch tax law (Art. 52 of the General Tax Act, Algemene wet inzake rijksbelastingen)
Portal messages and attachmentsUp to 2 school years after the end of the school year in which they were sent, or longer when they relate to a student record that is still kept.
Messages copied from the School’s Wix website (sent on or after 1 September 2022)Kept as the record of the School’s earlier communication until 31 August 2029 at the latest, then deleted. Any earlier deletion request is handled as for other Portal messages
School documents and parents’ read confirmationsAs long as the document is in use, and up to 2 school years after it is archived. Board documents are kept as long as the association’s statutes or the law require
Safe pick-up and photo consent formsThe school year they are for, plus 1 school year. Photo choices are deleted earlier when the child leaves the School, unless needed to show that consent was given for something already published
Trip and event answersUp to 1 school year after the trip or event
Email logUp to 12 months
Staff accountsFor the duration of the role. After the role ends, the account is deactivated and deleted within 12 months, except data needed for financial records.
Meetings (requests, parent–teacher bookings, attendance answers, parents' questions, notes and minutes)Up to 5 years after the meeting. Minutes of board meetings are kept as long as the association’s statutes or the law require
Personal notes, drawings and to-do lists (“My notes”)Private to the person who wrote them. Notes not changed for 12 months are deleted (with a reminder one month before); notes the person archives are kept until they delete them. To-do items are kept until the person deletes them. Everything is deleted about 30 days after the account is closed.
Audit log and security logsUp to 2 years

Each school year, the School reviews old records and deletes data that is no longer needed. Student and family numbers are never reused for other people.

When records reach the end of their retention period, an authorised administrator removes them from the Portal. Before removal, they may be saved in an archive file encrypted with AES-256 and protected by a password that is not stored in the Portal. Archive files and full backups of the database are made only by the School’s system administrator (or, in an emergency, the person named by the system administrator). They are kept offline or on encrypted storage, are not shared, and are used only to recover from a mistake or to meet a legal obligation. They are deleted once they are no longer needed for that, and reviewed at least once every school year. Every archive, restore and backup is recorded in the Portal’s maintenance log.

13. Security

We take appropriate technical and organisational measures to protect personal data against loss and unauthorised access, including:

If a personal data breach occurs that is likely to create a risk for you, we will report it to the Dutch Data Protection Authority within 72 hours where required. If the risk is high, we will also inform you.

Please keep your own password secret and tell us immediately if you think someone else has used your account.

14. Your rights

Under the GDPR you have the right to:

To exercise these rights, email elliniko.scholio.rott@gmail.com. We may ask you to confirm your identity. We will respond within one month; in complex cases this period may be extended by two further months, and we will tell you if it is. Exercising your rights is free of charge.

15. Complaints

If you have a concern, please contact us first so that we can try to resolve it. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority in the EU country where you live.

16. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects for you. Automatic absence emails are simply notifications of attendance recorded by a teacher. The Class planner only suggests class groups; the Principal and the office check and change every plan, and parents are told their child’s class only after the School has made the plan final.

17. Changes to this policy

We may update this policy when the Portal or the law changes. The current version is always published on this page, with the date it was last updated. If we make significant changes, we will also inform users through the Portal or by email.

18. Contact

Vereniging van Ouders Griekse School Rotterdam · Greek School Rotterdam
Maria Danneels Erf 18, 2907 BD Capelle aan den IJssel, the Netherlands
Email: elliniko.scholio.rott@gmail.com

See also our Terms of Service.